emotet | ae814d13ed0a680a5b2fa7cb6aab141f565e7efc90e0d789d91e354604c86695

Analysis

Target
87533c59cef14f69e0aa8dcf42733150.dll
Size 518KB
Sample220612-bt375schb9
SHA256 ae814d13ed0a680a5b2fa7cb6aab141f565e7efc90e0d789d91e354604c86695
MD5 87533c59cef14f69e0aa8dcf42733150
SHA1 4d1bf927c4458a3a13b8109e30c63796dcf9a020
SHA512 741089c33a8c86ddd6be5e58de51eee03fb07265a523fde01f18da30e47dcd96426344c47155e3b5c1910d9dc1a58a99d64b8e2473c80724cac6f4b735593468
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1640	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27
PID 1640 wrote to memory of 960	1640	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\87533c59cef14f69e0aa8dcf42733150.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JkESOdvMeFN\fdLH.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960

memory/1640-54-0x000007FEFBCF1000-0x000007FEFBCF3000-memory.dmp

Download

memory/1640-55-0x0000000180000000-0x000000018002A000-memory.dmp

Download